* fix(ime): keep plain-committed Hangul so macOS 2-Set can rebuild it in place
Right after an input-source switch, macOS 2-Set can commit a lone jamo as
plain text and then rebuild it (ㅇ + ㅏ → 아) by replacing that committed
range. The native text forwarder emptied the field after every commit, so
the replacement had nothing to land on and the vowel was dropped (#9738).
Keep Hangul commits in the field (Latin commits still clear for #11504),
and erase replaced text from the PTY before the replacement is sent.
* fix(ime): only erase retained Hangul when the replacement is forwarded and still at the PTY cursor
Drop retention on blur, on any composition start, and on chord/named keydowns
the pane handles before the forwarder (macOS Ctrl+C, non-Latin control chords).
Erase only for insertText/composition replacements that end at the field tail.
* ci(e2e): route terminal IME changes to IME specs again after the input/ owner move
#39113 moved IME and keyboard policy files under terminal-pane/input/, but the
native IBus and synthetic IME routes still matched the old paths, so IME changes
selected neither lane.
* refactor: organize WSL guest modules by concrete ownership
* chore: link historical relay evidence to the moved command
* chore: prune retired guest test timing debt
* Improve bug report template for desktop, remote, and mobile
Capture where users hit the bug (local desktop, SSH, remote server, WSL, mobile, web) without extra host jargon, and collect remote OS when relevant. Extend the OS labeler for mobile.
* Reconcile OS and mobile labels from the bug form's current state
Form: one "Where were you using Orca?" choice (Desktop only, + SSH host,
+ Orca server, + WSL, Mobile app, Web browser, Other), device OS with iOS
and Android, optional remote host OS, shorter help copy and per-platform
version instructions. Main's English request is kept.
Labeler: read the issue as it is now instead of the webhook snapshot,
recognize only a bug form at the very start of the body (optionally after
the exact machine-translation note line), and stop at the free-text
heading. Unknown, repeated, out-of-order or multi-line metadata leaves
labels untouched. Only os:macos, os:Windows, os:linux, os:mobile and
mobile are ever added or removed, one label at a time, so labels added
concurrently by people or other workflows survive. Each pass is verified
by a re-read and retried up to three times; runs are serialized per issue.
Fixes stale mobile labels after an edit to desktop, stale OS labels after
an edit to Other or blank, empty sections reading the next heading as a
value, quoted form sections relabeling unrelated issues, and prototype
names such as "constructor" being sent as labels. Retired Where option
strings and the Client / Host operating system headings keep working for
open issues.
Tests run the workflow's inline script against a stateful mock of the
issues API.
* Trim OS labeler tests to behaviour that fails when the fix is reverted
Review finding F11140-C1-1: several added tests pinned form copy, option
inventories, schema keys, workflow constants or script source, and kept
passing with the production change reverted.
- Delete bug-report-issue-form.test.mjs (schema keys, copy, option lists,
About-menu source regexes). The form/labeler contract is kept as one
behavioural case: every option the shipped form offers is recognised.
- Drop the workflow-constant and script-source regex tests, the log-copy
assertion, the note-length check and the plain-string label case.
- Replace the Where x OS matrix (with its test-side oracle) and the other
Cartesian tables with one literal case per distinct behaviour.
- Point negative fixtures at an OS the old script would label, so each
kept case fails against the reverted workflow rather than passing because
the old script skipped iOS.
220 -> 59 tests; all 59 fail with only the workflow reverted to main.
Test-only change; no runtime path changed.
* Keep the shadowed legacy value case in the heading-presence test
It covers a distinct rule (an invalid legacy value is ignored when the
current heading is present) and was dropped by mistake in the trim.
* Give terminal agents a lasting Orca Agent ID
Terminal agents now get an Orca ID (orca_session_id:<agent>_<uuid>) derived
from their own conversation id on the host that runs them, so it stays the
same across worktree sleep/wake, app restart and a hand-run resume in any
pane. The terminal pane menu gets Copy Agent ID beside Copy Session ID, and
worktree ps --json agent rows carry orcaSessionId. Messaging a terminal
agent by that ID is refused with a message naming its pane until terminal
delivery lands.
* Name terminal agents at row admission and fix review round 1
- Perf: a row's Agent ID is resolved once, when its provider key changes at
admission (legacy rows via the status adapter's prepareRow hook, tmux rows at
canonical commit) and carried on the row as runtime-only agentIdentity.
Snapshots, publications and internal notifications only copy it; no key
serialization, cache lookup or database access per walk. Drops the pane FIFO
cache.
- Refusal: the identity service keeps a reverse index id -> rows, kept exact by
the adapter's rowChanged hook; a terminal refusal reads only matching panes
and names only confirmed running ones (no resume seeds, exited or
unconfirmed restored rows).
- Retry: a read-only identity file is lookup-only and never mints; any store
failure backs off all SQLite work for 30 s; a Copy click retries once.
- Menu: Copy Agent ID shows for a live pane only when its host stamped an ID,
and for a sleeping pane only when this app owns it on macOS/Linux.
- SSH: a sleeping record keeps its connection; a foreign (non-WSL) one resolves
no ID.
- Renderer keeps an existing ID only for the same agent, owner and provider key
including the Pi transcript locator.
- tmux-selected terminal rows carry their ID at every snapshot seam and in Copy
resolution; structured chat rows stay excluded.
* Keep Agent ID work out of notifications and reach Copy wherever a host can answer
- Internal status/provider notifications walk rows without Agent ID work:
canonical (tmux-selected) rows are decorated only for outputs that carry
the id (snapshots, live emit, ps, Copy). The tmux publish body is now
publishTmuxSelectedStatus so tests drive the production path.
- A row this host can name but has not yet (failed or pending link) is
published with orcaSessionId: null; older hosts omit the field. The
renderer offers Copy Agent ID on a live row whenever the field is present,
and the click retries through terminal.agentId.
- Hosts advertise terminal.agent-id.v1. A sleeping pane offers Copy Agent ID
when its owner is this app on macOS/Linux, or a remote owner that advertises
the capability on a known non-Windows platform, and its record names no
foreign connection.
- "Running in pane" places require that this runtime observed the row; a
saved status, Done included, is history.
* Guard the pane menu subscription and stop offering Copy where it can never succeed
- A settled read-only miss (no link in a newer build's identity file) no
longer publishes orcaSessionId; only a resolved id or a pending failed link
does, so Copy Agent ID is offered only where a click can succeed.
- Render contract for the per-pane menu selection: another pane's or host's
status change re-renders no unaffected pane; a pane's own stamp flips its
availability.
* Move terminal agent identity SQL into a worker thread
Main's blocking-SQLite ratchet forbids the synchronous identity store, so
(per the decider ruling) agent-identities.db is now owned by one lazy
worker-thread entry per hook-server owner, desktop and orcad alike.
- The schema, open/version handling, mint/link transaction and read-only
behaviour move unchanged into agent-identity-worker-entry.ts; main keeps
only the key type, path and an async client over WorkerThreadRequestQueue.
- Admission stays synchronous: a new key is published pending (null), one
request per exact key is shared by every row and click, and the committed
answer re-stamps the current rows still pending on that key (legacy and
tmux-selected) as identity-only replays. Replies are fenced by store
generation, key and current subscription; failures back off 30 s and a
Copy click retries once.
- terminal.agentId and the terminal-ID refusal are async: Copy waits for the
pending lookup and revalidates the pane; send/task routing resolves the
terminal recipient (awaiting the store's has() on an index miss) before
any synchronous routing or effects.
- The renderer treats the host's row naming a conversation as authoritative
for its id, so a settled miss clears a pending null, while ID-less local
updates keep it.
- Packaged for desktop and orcad; registered as a worker entry, no baseline
growth.
* Own identity demand per key, publish settled ids as projections, recheck authority
Implements the second decider ruling for the identity worker:
- One owner-level demand table replaces the per-key promise backlog and the
settled-row scan: each exact key a current row or caller needs has one
record (identity, places, waiters); the pump sends the worker one operation
at a time, only for keys still needed, so a healthy burst completes and
detached keys are never sent. Operation deadlines start at dispatch; a
caller's wait expiring never drops a row's demand.
- One failure gate for lookups and membership: after a failure nothing is
sent for 30 s except one coalesced Copy attempt; a single owner wake
retries while rows still wait, and cancels with the last demand or close.
- The retirement barrier outlives a client: a replaced worker must exit
before another starts; a different store path is a different authority.
- Settlement re-stamps the stored row and publishes a projection only: window
readers get the row without its hook event (no agent-state record) and
session.tabs is woken by a row touch; no enriched subscriber, plugin event
or freshness heartbeat runs again.
- Copy and terminal membership check the owner generation after their waits.
A known chat is decided by the chat store alone; send, peer mail, reply and
assignee admission resolve the terminal recipient before reading the facts
they act on, recheck the sender after the wait, and group send reselects
its audience and mailboxes after each wait before writing.
* Scope identity answers to their store authority, expire Copy grants with callers, index provider aliases
- One synchronized authority token before Copy/reverse fast paths, compared after their awaits;
answers carry their authority and an ended store turns rows, tmux subjects and the reverse
index pending together. Status path changes sync the authority outside admission.
- A failed operation reschedules the pump so a queued click gets its attempt; grants belong to
live waiters and a click joining a running attempt earns none.
- Provider-native ids resolve through a commit-maintained alias index at the record store.
- Group fan-out no longer classifies authoritative candidates; @idle rereads statuses with
current candidates before the final synchronous selection.
- Hook-server unit fixtures use an in-memory identity client; a real worker load/stop failure
check covers the worker boundary.
* Pick a shared provider alias's owner among its owners only
The alias index keeps the store's listing order (readable, then unreadable) as derived ranks, updated from the draft's appended keys on commit, so a duplicate alias no longer walks the history per lookup.
* Ask a remote pane's host for its Agent ID by the host's own pane key
Copy Agent ID on a web-terminal surface sent the client's mirrored pane key, which the execution host does not know, so it answered null.
* Keep focus where the user moved, recover a missed identity re-stamp, ack peer-mail replays first
Copy Agent ID refocuses its pane only when focus is unclaimed or still in the pane; a carried pending row takes its key's settled answer; an already-delivered peer-mail retry is acknowledged before recipient preparation.
* fix(settings): drop nested cards from Worktree hooks
The orca.yaml status, its parse-error callout and the local-scripts notice drew bordered panels inside the Worktree hooks card. Render them as flat rows; code blocks and inputs keep their borders.
* fix(settings): show healthy orca.yaml status as a collapsed row
Loaded and missing orca.yaml now render as a disclosure row under Command source instead of a tinted card inside the Worktree hooks card; the script preview or template is collapsed by default. Parse-error and update-available keep their warning card. Advanced content is indented to line up with its label. Restores the local-scripts notice card from main.
* chore(i18n): drop orca.yaml status strings the new row no longer uses
* fix(settings): keep orca.yaml row inside design-system lint rules
* fix(mobile): let the chat transcript scroll by touch on the phone's web pages
Gesture handler 3 (Expo 58 upgrade, #37935) gives a GestureDetector's view
touch-action: none on web by default. The chat transcript's pinch-to-zoom
detector sits on its scroller, so in the phone's WebView pages the browser
refused every touch pan and no chat could scroll. Gesture handler 2 left it
at auto.
The row list now wraps its own scroller in MobileNativeChatPinchZoom, which
keeps touch-action: auto. A browser render check pins the scroller's
touch-action under the detector.
* fix(mobile): keep the transcript pinch on its text size, not page zoom
touch-action: auto let a two-finger pinch on the transcript zoom the whole
page in the phone's web pages, so the transcript's text-size pinch never ran
and a zoomed page stopped the composer lifting over the keyboard.
pan-x pan-y keeps one-finger scrolling (and sideways code blocks) with the
browser and hands the pinch to the detector.
The render check now pans the transcript with one finger and pinches it
with two, asserting it scrolls, the text scale changes and the page stays
at scale 1.
* Antigravity settings: flatten into agy terminal and Chats cards
Replace the nested Antigravity card with two flat settings cards. Saved agy
accounts become Codex-style rows (click to select, Active badge, Remove), the
current login gets an inline Save, and usage refreshes from the active row.
Chats lists Sign in with (Enterprise fields inline), Account status with its
action, then Chat runtime.
* Use primitive variants for Antigravity row buttons and badge
* Antigravity settings: speak usage values and keep the /logout step
OrcaWinandOrcaWin
Neil
Jinjing
Brennan Benson
Jinwoo Hong